If they are tunnels that will be used for external communication, it is required that at least one of the ends have a fixed public IP.

However, it is possible to configure tunnels on MikroTik routers without having to have a fixed IP on both ends. This can be especially useful in scenarios where dynamic IP addresses are common, such as residential or small business internet connections.

Below we give you some options and methods to achieve this:

1. Dynamic DNS (DDNS)

A common solution to handle dynamic IPs at both ends of a tunnel is to use the Dynamic DNS (DDNS) service. DDNS allows a domain to automatically update with the router's current IP address when it changes. MikroTik supports several DDNS services, and you can configure DDNS on your routers so that domain names always point to the correct IP addresses, regardless of whether they change.

2. IPsec with IDs

IPsec can be configured to use identifications (IDs) instead of fixed IP addresses to establish authentication and tunnel parameters. This allows routers to identify and authenticate each other by a tunnel ID or certificate, rather than by their IP address, which is useful when addresses can change.

3. OpenVPN with Name Resolution

OpenVPN is another option that you can configure in MikroTik and that handles dynamic IPs well. OpenVPN can be configured to use domain names (which are updated via DDNS) instead of static IP addresses for tunnel endpoints. This makes it easier to manage VPN connections in environments with dynamic IP addresses.

4. GRE over IPsec

The GRE (Generic Routing Encapsulation) protocol can be used in conjunction with IPsec to create tunnels that are less dependent on static IP addresses. IPsec can be used to secure the tunnel while GRE encapsulates the packets. Combining GRE with IPsec and DDNS can provide a robust and flexible solution for tunneling in dynamic environments.

5. Use MikroTik Scripts

You can write or configure scripts in RouterOS that detect IP address changes and automatically reconfigure tunnel parameters or notify an external system to update relevant records such as DDNS or firewall settings.

Conclusion

Using these technologies and strategies allows you to create and maintain tunnels between sites with dynamic IP addresses, taking advantage of the advanced configuration and scripting capabilities of MikroTik RouterOS.

The key is to correctly configure DDNS services and select the right type of VPN or tunnel that best suits your needs and network environment.